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(57) ABSTRACT 

A novel system and method for communicating over a 
non-continuous connection with an entity on a local area 
network (LAN) reduces the costs and risks associated with 
maintaining a continuous connection between the LAN and 
an external network, such as the Internet. The invention may 
use a trusted arbitrator as an intermediary between the LAN 
and external entities seeking to communicate with an entity 
within the LAN. Requests from external entities are routed 
to the trusted arbitrator, which contacts a connection entity 
within the LAN. The connection entity authenticates the 
contact and causes a connection to be established to the 
external network and thereby with the trusted arbitrator. 
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SYSTEM AND METHOD FOR network, the proxy may act as a client, forwarding the 

COMMUNICATING OVER A NON- incoming transmissions which conform to its rules. For 

CONTINUOUS CONNECTION WITH A example, the proxy may prevent executable files from enter- 

DEVICE ON A NETWORK m 6 tne LAN DUl ma y P ass a ll incoming responses to HTTP 

5 queries that were sent by devices within the LAN. 

Unfortunately, the characteristics that make firewalls or 

BACKGROUND OF THE INVENTION proxies effective in controlling the flow of information into 

i c" u f #u t lne network also lead to increased complexity and cost. For 

1. hield ot tne invention example, when an entity outside the LAN, such as remote 
The present invention is directed to communicating with computer 20c, seeks to be connected with an entity within 

a device on a network. More specifically, the present inven- the LAN, such as computer 10a, complex and/or costly 
tion is directed to communicating over a non<x>ntinuous changes to the ACM may be necessary to permit the con- 
connection with a device on a network. nection. In addition, significant processing resources are 

2. Description of Related Art and General Background consumed in evaluating all gateway traffic to ensure com- 
A network is a system of computers that are connected to P^ 006 with the network's security rules and thereby protect 

each other (and possibly to terminals and other peripheral the n * work from potentially harmful traffic. Furthermore, it 

devices) by communications lines which may be physical m ^ bc ^practical and/or expensive to maintain a contmu- 

ji • i ~ , . * i u ous connection between the LAN and the external network 

and/or wireless. Each computer on a network may be , ^ Interne t) 

gene rally classified as a* client* (i.e. a computer that initiates * c n , c ^ nc 4 . L1 • 

( w • j Some solutions to these problems of overhead — such as 

requests) or a 'server' (i.e. a computer that receives and ~ n * -J j j- 7j Z* ■ *l e n *L \, — % 

j . . \ uu u • i * i 20 setting aside a dedicated, open port in the firewall through \ 

responds to requests;, aimougn a single computer may aiso which external traffic 

may enter — may create unacceptable / 

perform different roles at different times. Transfers of infor- secufi ^ Qih ^ mQ £ solut i o ns inchlde £^ 1 / — 

mation across the network are typically conducted in com- private n^vmrlSTfmtSrvnmr wt encryption to al l ow ( <0<J?^ 

pliance with one or more network protocols to ensure that ?u ^cani^twnrk* to exchange inform ation with / ^ 

the information may be properly delivered and interpreted. 25 e ach other in a secure manner over theTnternetT" T his 

One such protocol is the Hypertext Transfer Protocol or encryp tion ettectivfi l y rrpatps a ^girp " t1inn ^l h fit WG f n 

HTTP, an application-level protocol that provides a basis for ^^vu^ ri; rr ;v,r ^ ihot th n ^h *u . ^e m m rt; n Z ~*y j 

information transfer across the Internet and is specified e.g. pas s, through many qfhp.r ftntii frr, during frflnsmminn, it is* ' ^ 'L ^® f 

in RFC 2616 ("Hypertext Transfer Protocol — HTTP/1. 1")> accessfole rmiy tn th* cp^pt anH thp receiver. 

R. Fielding et al., June 1999, which document is available at 30 Although a VPN offers a higher level of data security, no 

http: ZHwww.ietf.org/rfc/rfc26 16.txt. As shown in FIG. 1, reduction in overhead processing is thereby achieved, as 

HTTP is a query/response protocol m which an entity such network traffic entering the LAN through the VPN must still 

as a client 30 directs a query for information to a specific pass through and be evaluated by the ACM. Adding a VPN 

resource (such as a file or web page, as identified by a to an existing network also involves a significant investment 

Universal Resource Locator or URL) and another entity 3S in resources and may introduce bugs or errors into a stable 

such as a server 40 forwards an appropriate response asso- system. Furthermore, in many network installations it may 

ciated with that resource. not be feasible to reconfigure an existing ACM to support 

A local area network (or 'LAN') allows computers or communication with every new external entity that may be 

terminals that are located near one another to share resources desired, as such modifications require extensive resources 

such as storage devices, printers, and other peripheral equip- 40 and testin S- 11 is desirable to reduce or avoid these costs and 

ment. A LAN that is connected to a larger network may risks. 

include one or more access points (or 'gateways') through BRIEF DESCRIPTION OF THE DRAWINGS 

which devices within the LAN may communicate with rT „ - . . a c , . . IT1Trn , 

j . . • j -i t a xt » \ , , . / FIG. 1 illustrates the flow of data in a HTTP query and 

devices outside the LAN. Access control mechanisms (or ^ J 

'ACMs') provide security against unauthorized access to the 45 reS J??? S ^ , , , , c . . 

LAN by controlling or restricting the flow of information , 2 shows f bl ° ck dia £ rara of a s y slcm includin S a 

across the access points. FIG. 2, for example, shows a LAN local area network and a remote com P uten 

230 that is connected to the Internet 250 only through an FIG 3 shows a block dia S ram of a s y slem according to an 

ACM 20a. Due to the presence of ACM 20a at this access embodiment of the invention. 

point, a remote computer 20c that is connected to the 50 FIG - 4 snows a flow cnart for a method according to an 

Internet 250 may not freely interact with devices connected embodiment of the invention. 

to LAN 230 such as computer 10a. Any request for infor- FIG. 5 shows a flow chart for a modified method accord - 

mation that is sent by remote computer 20c to computer 10a ing to an embodiment of the invention, 

will be scrutinized by ACM 20a and may be rejected. FIG. 6 shows a flow chart for an extension of a method 

One type of ACM is a firewall. The term 'firewall' 55 according to an embodiment of the invention, 

indicates a protective layer that separates a computer net- FIG. 7 shows a flow chart for an alternate extension of a 

work from external network traffic, and this layer may be method according to an embodiment of the invention, 

implemented in software, hardware, or any combination of FIG. 8 shows a block diagram of a system according to an 

the two. For example, firewall application software may be embodiment of the invention, 

installed on a server to create a combination called a 60 FIG. 9 shows a block diagram of a system according to an 

'firewall server/ Another type of ACM is a server (possibly embodiment of the invention. 

a firewall server) running an application program that evalu- pjc. 10 shows a block diagram of a system according to 

ates incoming requests according to a predefined set of rules an embodiment of the invention, 

(also called 'packet filtering')- Such a device is called a nccrorcrnnw 

'proxy server' or simply a 'proxy/ To entities outside the 65 DETAILED DESCRIPTION 

network, the proxy may act as a server, receiving and FIG. 3 shows an overall perspective view of a first 

evaluating incoming transmissions. To devices within the embodiment of the invention. A remote computer 20c is 
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connected to a network such as the Internet 250. A LAN 230 
comprises various components including a local computer 
10a and a connection entity 10b (discussed below). Other 
components such as additional computers, printers, and file 
servers may also be connected to LAN 230. 

LAN 230 is connected to an external network (here, the 
Internet 250) through ACM 20a, which protects components 
within LAN 230 from external network traffic by intercept- 
ing communication requests that are sent directly to these 
components from entities outside the network. The commu- 
nications link 256 between LAN 230 and the external 
network is not continuously operational, however. Rather, 
this link is maintained by communications controller 25a, 
which brings up link 256 on an as-needed basis as instructed 
by, e.g., ACM 20a and then releases it. In one 
implementation, communications controller 25a is a dial-up 
router and link 256 is supported via modem over a telephone 
line. Communications controller 25a may be configured in 
various different ways: for example, it may maintain link 
25b until explicitly instructed to close it, or it may maintaio 
link 25b only for a specified period of time, or it may 
maintain link 25b only until a predetermined timeout period 
has passed since the most recent information transfer 
between LAN 230 and the external network. 

A trusted arbitrator 20b is also connected to the Internet 
250. Subject to the restrictions dictated by ACM 20a (and 
the status of link 25b as controlled by communications 
controller 25a), information may thereby flow among enti- 
ties connected to LAN 230, remote computer 20c, and 
trusted arbitrator 20b, (The term 'entity* as used herein 
refers to any device or process that originates or terminates 
a request for information. For example, an entity may be a 
computer, an application program, or an embedded 
processor.) 

One of the entities connected to LAN 230 is a connection 
entity 10b, which interacts with trusted arbitrator 206 
regarding communication requests sent by external entities 
(such as remote computer 20c) to devices within LAN 230. 
Connection entity 10b may reside on a device such as a 
router, on a dedicated computer, or on a computer that 
performs other tasks as well (for example, ACM 20a and 
connection entity 106 may reside on the same entity). 
Regardless of the form of connection entity 106, trusted 
arbitrator 206 communicates with connection entity 106 to 
transmit requests from one or more external entities (such as 
remote computer 20c), such requests being directed to one 
or more entities within LAN 230 (such as local computer 
10a). 

In addition to the communications pathway which 
includes communications link 256, another communications 
pathway exists between trusted arbitrator 206 and connec- 
tion entity 106 which includes communications link 25c. 
Upon receiving a request from an external entity that is 
directed to an entity within LAN 230, trusted arbitrator 206 
contacts connection entity 106 over communications link 
25c. In one implementation, communications link 25c 
includes a telephone line, and trusted arbitrator 206 initiates 
the contact with connection entity 106 by making a tele- 
phone call to a modem (not shown) that communicates with 
connection entity 106 or may be a part of connection entity 
106. Connection entity 106 then terminates the contact over 
communications link 25c and begins to communicate with 
trusted arbitrator 206 via communications link 256. (In some 
implementations, communications link 256 and communi- 
cations link 25c may share the same telephone line.) Upon 
retrieving a request from trusted arbitrator 206 that is 
directed toward an entity within LAN 230, connection entity 
106 forwards the request to the appropriate entity via LAN 
230. 
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In this embodiment of the invention, remote computer 20c 
sends communication requests for local computer 10a to 
trusted arbitrator 206 over the Internet 250, rather than 
directly to local computer 10a through ACM 20a. Remote 

5 computer 20c sends these requests (e.g. in response to a 
user's keyboard or mouse requests, or as directed by an 
application program, or in response to a request by a client 
within a LAN that includes remote computer 20c) to trusted 
arbitrator 206 through the arbitrator's website, which is 
0 accessed by using its Universal Resource Locator (URL). 
Connection entity 106 may also exchange information with 
trusted arbitrator 206 through this or another URL associated 
with trusted arbitrator 206. 

Before remote computer 20c is permitted to communicate 

1S with an entity within LAN 230, trusted arbitrator 206 
performs a certification process in order to establish the 
validity of the request sent by remote computer 20c. In one 
implementation, trusted arbitrator 206 certifies the request 
by verifying the identity of remote computer 20c. By virtue 

20 of such a certification process, an impostor may not assume 
the identity of remote computer 20c without running afoul of 
trusted arbitrator 206. In another implementation, trusted 
arbitrator 206 assigns an authentication identity to remote 
computer 20c upon certification. In a further 

25 implementation, trusted arbitrator 206 certifies the request 
by verifying that remote computer 20c is capable of trans- 
mitting and receiving information in a secure manner. 

Thus, in order to request communication with an entity 
within LAN 230 such as local computer 10a, remote com- 

30 puter 20c transmits a request through a network such as the 
Internet 250 to trusted arbitrator 206. In one implementation, 
remote computer 20c makes this request by contacting 
trusted arbitrator 206 through its website and thereby sup- 
plying the trusted arbitrator with information about the 

35 request: for example, the identity or location of LAN 230, 
the nature of the request, and the particular entity within the 
LAN to which the request is directed. 

Upon receiving a request from remote computer 20c that 
is directed toward an entity within LAN 230, trusted arbi- 

40 trator 206 contacts connection entity 106 over communica- 
tions link 25c. Before or during this contact, a basis for 
identification of trusted arbitrator 206 by connection entity 
106 (or, alternatively, a basis for identification of connection 
entity 106 by trusted arbitrator 206) may also be established. 

45 For example, connection entity 106 may authenticate this 
contact via a predetermined secret that is shared by connec- 
tion entity 106 and trusted arbitrator 206. Connection entity 
106 may establish the basis for identification by selecting 
trusted arbitrator 206 as its intermediary for all requests 

so directed to entities within LAN 230. In one embodiment, 
connection entity 106 connects to trusted arbitrator 206 
through the trusted arbitrator's website, exchanging infor- 
mation with trusted arbitrator 206 that will allow the two 
entities to continue to communicate with each other in the 

55 future. For example, trusted arbitrator 206 may provide 
connection entity 106 with an authentication identity that 
connection entity 106 can use in future communication with 
trusted arbitrator 206. 

It is possible that trusted arbitrator 206 may service 

60 several different LANs and/or several different remote enti- 
ties. In such case, trusted arbitrator 206 may also forward a 
URL to connection entity 106 over communications link 
25c, wherein the URL identifies the location to which 
connection entity 106 may direct its communications with 

65 trusted arbitrator 206 over communications link 256. This 
feature reduces the need for trusted arbitrator 206 to dedicate 
fixed resources such as a particular URL to remote computer 
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20c or to LAN 230 and allows trusted arbitrator 206 to 
dynamically reconfigure its communications interface. 

FIG. 4 illustrates a method according to an embodiment 
of the invention. In block P110, upon receiving a request 
from remote computer 20c, trusted arbitrator 206 certifies 
the request by, for example, verifying the identity of remote 
computer 20c. In one implementation, trusted arbitrator 206 
certifies the request by verifying identification information 
which remote computer 20c forwards along with the request. 
If the certification is successful, then trusted arbitrator 20ft 
processes the request; otherwise, trusted arbitrator 206 
rejects the request. 

If trusted arbitrator 206 determines that it has received a 
valid request from remote computer 20c, then in block P120 
trusted arbitrator 206 organizes the request for forwarding to 
connection entity 106. In one implementation, trusted arbi- 
trator 206 adds the request to a queue in a secure area within 
its website that may be designated for connection entity 106 
(i.e. for LAN 230). The organization of this secure area may 
be dynamically reconfigurable to promote the efficient pro- 
cessing of requests originating from multiple remote entities 
and/or directed to multiple LANs. 

In block P130, trusted arbitrator 206 initiates contact with 
connection entity 106 over communications link 25c. In one 
implementation, this task is performed by making a tele- 
phone call to a modem that communicates with connection 
entity 106. In block P135, connection entity 106 authenti- 
cates the communication received from trusted arbitrator 
206 over communications link 25c. For example, connection 
entity 106 may authenticate the communication on the basis 
of a shared secret known to connection entity 106 and 
trusted arbitrator 206 (e.g. information based on a preas- 
signed or predetermined identity). As noted above, some 
implementations may support an additional exchange of 
information between trusted arbitrator 206 and connection 
entity 106 during this communication, such as the identifi- 
cation of a URL through which further communication with 
trusted arbitrator 206 may be conducted over the Internet. 

Upon authentication (and the completion of any further 
exchange of information as appropriate), connection entity 
106 terminates the contact with trusted arbitrator 206 over 
communications link 25c (block P140) and opens commu- 
nications link 256 (block P145). In the system of FIG. 3, for 
example, connection entity 106 (whether directly or indi- 
rectly via, e.g., ACM 20a) causes communications controller 
25a to establish an active communications link to the 
external network. Communications controller 25a may 
establish this link by, for example, making a telephone call 
to a server (not shown) that is maintained by an Internet 
service provider (ISP). 

In block P150, connection entity 106 opens a HTTP pipe 
by sending a HTTP query to trusted arbitrator 206. Trusted 
arbitrator 206 then forwards the request or requests residing 
in the corresponding queue to connection entity 106 in the 
form of packets attached to the HTTP response to that query 
(block PI 60). Because this HTTP response is associated 
with a HTTP query that connection entity 106 initiated, it 
passes through ACM 20a without being evaluated. In 
addition, because the HTTP response originated from an 
entity that is trusted by connection entity 106, connection 
entity 106 is assured that the HTTP response is secure. As 
indicated in block P170, connection entity 106 routes the 
information within the HTTP response to the appropriate 
entity within LAN 230 (e.g. as indicated within the 
response). If the response indicates that the information 
relates to records that are located on a storage medium of 
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local computer 10a, for example, connection entity 106 
routes the information to local computer 10a for processing. 

In one exemplary use, remote computer 20c may wish to 
send a HTTP query to local computer 10a. Because remote 

5 computer 20c is not known to ACM 20a, a query sent by 
remote computer 20a directly to local computer 10a will not 
reach its destination. If the query is sent by trusted arbitrator 
206 as a pay load to a HTTP query as described above, 
however, then it will be admitted by ACM 20a and for- 

1° warded to local computer 20a as desired by connection 
entity 106. Thus the overhead of configuring the system to 
allow direct secure communication with remote computer 
20c is avoided without compromising the security of LAN 
230. 

15 In a modification of a system and method as described 
above, connection entity 106 detects whether a communi- 
cations link 256 is active. If link 256 is not active, then 
connection entity 106 waits to receive a contact from trusted 
arbitrator 206 over communications link 25c (e.g. as shown 

20 in block P135 of FIG. 4). If link 256 is active, however, 
connection entity 106 uses it to poll trusted arbitrator 206 at 
regular intervals to determine whether any requests directed 
toward entities within LAN 230 may be ready for forward- 
ing. In such an implementation, trusted arbitrator 206 may 

25 delay initiating the contact over communications link 25c 
for a period on the order of the expected interval between 
polling inquiries. If a response from trusted arbitrator 206 
via communications link 256 indicates that requests are 
ready for forwarding to connection entity 106, then connec- 

30 tion entity 106 opens a HTTP pipe to trusted arbitrator 206 
(e.g. as shown in block P150 of FIG. 4). In a further 
modification, a polling inquiry itself may open a HTTP pipe 
through which the requests may be forwarded by trusted 
arbitrator 206. 

FIG. 5 shows a method according to a further embodiment 
of the invention wherein connection entity 106 detects 
whether communications link 256 is already active (block 
P142). In this implementation, for example, connection 

4Q entity 106 shares the same communication line as ACM 20a, 
and it is possible that communications link 256 has already 
been established for another purpose. If no link is detected, 
connection entity 106 opens communications link 256 as 
described above. 

45 As shown in FIGS. 6 and 7, any response to the incoming 
information that is subsequently generated by the target 
device (in this case, local computer 10a) may be forwarded 
back to remote computer 20c in an analogous fashion. In 
block P210, local computer 10a sends the response infor- 

50 mation to connection entity 106. In block P220, connection 
entity 106 forwards this information to trusted arbitrator 206 
via, e.g., a HTTP query. Trusted arbitrator 206 extracts the 
information destined for remote computer 20c and stores it 
in a secure area within its website. Trusted arbitrator 206 

55 may also acknowledge receipt of the query in a HTTP 
response to connection entity 106 

If remote computer 20c has a continuous connection to 
the external network (here, the Internet 250), then the 
method may proceed as shown in FIG. 6. After sending its 

60 request as described above, remote computer 20c polls 
trusted arbitrator 206 periodically in order to determine 
whether a response is available. In block P230 of the 
implementation shown in FIG. 6, for example, polling is 
performed via HTTP queries. If a response has been received 

65 from local computer 10a through connection entity 106 
(block P240), then the information is forwarded to remote 
computer 20c. In this example (block P250), the information 
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25b and the entities within LAN 230 is provided for. For 
example, such capability may be provided for within a 
gateway server that does not perform the scrutinizing func- 
tions of an ACM. Alternatively, such capability may be 
5 provided for within communications controller 25a, as in the 
system shown in FIG. 8. 

The invention mav also be applied to all nw the imple 
m entation of a VPN hetween. for example, trusted arbi trator 
2 06 and LAN 230 over a non-continuous connec tion 
10 between LAN 230 and an external network. An alterna tive 
a rrangement is shown in FIG. 9, wherein remote compu ter 1 
20c is connected to the external netw ork (here r the internet 
zmij, possibly through a non-continuous r nnnpf>t inrL g1 ' rh as 
a dial-up telephone line. Remote com puter 20c is also 
I s c onfigure d to communicate with LATvJ 230 over a VPN (as 
described, lor^ example, in Enubltng Steu reViriual P rivate 
Ne tworKTOvW \he Imetnei, whlte_rj apjL!Sa^NP0g94.0 1 , 
Inte LCorp., Santa Clara, Calif.). Communications link 256 
is n ormally inactive, thus preventing remote com puter 20c 
fr om establishing a VPN connection and accessing the LAN 
over JfrgLPXternnl network. 

In order to activate the VPN, remote computer 20c 
contacts connection entity 106 over communications link 
25c. This contact is similar to the one described above over 
this link between trusted arbitrator 206 and connection entity 
106, and data such as certification information, URLs, and 
requests directed toward local entities may (but need not) be 
transmitted during this contact in a like manner. If this 
contact and any associated certification procedures are 
successful, then the contact over communications link 25c is 
terminated and communications link 256 is opened (as 
discussed above with reference to block P145 of FIG. 4). 
Assuming that remote computer 20c has established its own 
connection to the external network by this time, the desired 
VPN connection is thus established. 

In a further alternative arrangement, remote computer 20c 
communicates over the external network with a directory 
service (i.e. an entity that contains a directory of computers 
and/or networks). The directory service then activates the 
VPN and communicates with the LAN as described above. 

Note that the non -continuous nature of communications 
link 256 offers a certain measure of network security. In 



is sent in a HTTP response to the polling query. 
Alternatively, remote computer 20c may open a HTTP pipe 
to trusted arbitrator 206 only after trusted arbitrator 206 has 
indicated that a response to the request of remote computer 
20c is available. 

On the other hand, it is also possible to practice the 
invention in a case where remote computer 20c (like LAN 
230) has a non-continuous connection to the external 
network, as shown in FIG. 7. After sending its request as 
described above, remote computer 20c is contacted by the 
trusted arbitrator 206 when a response is available. In block 
P260 of the implementation shown in FIG. 7, for example, 
trusted arbitrator 206 initiates a direct communication with 
remote computer 20c. This direct communication may 
include making a telephone call to a modem that commu- 
nicates with remote computer 20c. After authenticating the 
communication received from trusted arbitrator 206 (block 
P270), remote computer 20c terminates this communication 
(block P280) and contacts trusted arbitrator 206 via the 
Internet (block P290). In this example, the remote computer 
20c contacts trusted arbitrator 206 by sending a HTTP query. 
Trusted arbitrator 206 then routes the packets received from 
connection entity 106 to remote computer 20c (block P250). 
In this example, the information is sent in a HTTP response 
to the query initiated by the remote computer 20c, 2 s 

A system and method according to an embodiment of the 
invention can support continued communications between 
an entity within the LAN and an entity outside it. In certain 
implementations, however, only limited communication 
abilities may be necessary. For example, the extent of a 30 
communication between the remote entity and the local 
entity may be limited to a single query and response. In such 
a case, a method according to a further embodiment of the 
invention may be used. In this method, any requests ready 
for forwarding are transferred by trusted arbitrator 206 to 3S 
connection entity 106 over communications link 25c before 
it is terminated. The responses to these requests are then 
transmitted to trusted arbitrator 206 over communications 
link 256 via HTTP queries; e-mail transmissions using, e.g., 
Simple Mail Transfer Protocol (SMTP); or any other suit- 
able technique. Alternatively, trusted arbitrator 206 may also 
transmit appropriate addressing information for the request- 
ing remote entities over communications link 25c before it 
is terminated, so that the responses to these requests may be some applications, therefore, it may be acceptable to prac- 
forwarded directly to those entities via communications link 45 tice the invention without using an ACM. In this case, it may 




40 



256 (e.g. by HTTP or e-mail) rather than indirectly through 
trusted arbitrator 206. 
* As described above, a method or apparatus according to 
, an embodiment of the invention allows a secure connection 
} to be established with an entity outside a LAN over a 
i non-continuous connection, without changing the infrastruc- 
\ ture of the LAN and while reducing monitoring costs. In one 
) implementation, this connection is supported by communi- 
/ cation through a trusted third-party website, thereby mini- 



only be necessary to ensure that a capability for routing 
traffic properly between communications link 256 and the 
entities within LAN 230 is provided for. For example, such 
capability may be provided for within a gateway server that 
does not perform the scrutinizing functions of an ACM. 
Alternatively, such capability may be provided for within 
communications controller 25c, as in the system shown in 
FIG. 10. 

The foregoing description is provided to enable any 



\ mizing the risk of damage to the LAN due to breaches by ss person skilled in the art to make or use the present invention 

\ unauthorized entities. Various modifications to these embodiments are possible, 

As for the methods described or suggested herein, many and the generic principles presented herein may also be 

of the tasks within such methods may be performed in applied to other embodiments. For example, an embodiment 

parallel or in different serial orders than as presented (for of the invention may use a connection entity that is imple - 

example, task P130 in FIG. 4 may be performed before or in 60 mented as any combination of (1) hardware such as a 



parallel with task P120, and task P150 need not occur after 
task PI 40). Additionally, because the non-continuous nature 
of communications link 256 offers a certain degree of 
security, it may be acceptable in some applications to 
practice the invention with a system that lacks an ACM. In 65 
this case, it may only be necessary to ensure that a capability 
for routing traffic properly between communications link 



computer or a device for processing network traffic such as 
a router, (2) firmware loaded into non-volatile storage, 
and/or (3) software loaded into random -access memory in 
the form of machine-readable code, such code being execut- 
able by an array of logic elements such as a microprocessor 
or other digital signal processing unit. The connection entity 
may also reside on a dedicated computer or may be simply 
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one among several tasks executing on one computer. 
Additionally, it is possible in certain implementations for the 
connection entity and the communications controller to 
include parts of the same hardware unit(s) and/or application 
or interface program(s). Thus, the present invention is not 
intended to be limited to the embodiments shown above, but 
rather, is to be accorded the widest scope consistent with the 
principles and novel features disclosed in any fashion 
herein. 
We claim: 

1. A system, comprising: 

a local area network, said local area network including (a) 
a local entity and (b) a connection entity coupled to the 
local entity; 

a trusted arbitrator coupled to the local area network; and 15 
a remote entity coupled to the trusted arbitrator, 
wherein the remote entity transmits a first request to the 
trusted arbitrator, the first request being directed at least 
in part to the local entity, and the trusted arbitrator 2 o 
verifies the remote entity as a valid requester, and 
wherein after beginning to receive the first request, the 
trusted arbitrator transmits a first communication to the 
connection entity, the first communication being trans- 
mitted at least in part over a first communications link 25 
that is terminated after the first communication is 
completed, and 
wherein after beginning to receive the first 
communication, the connection entity transmits a sec- 
ond communication to the trusted arbitrator, the second 
communication being transmitted at least in part over a 
second communications link being a non-continuous 
communications link, and 
wherein the second communication comprises informa- 
tion directed to the remote entity relayed by the trusted 
arbitrator and is responsive to the first request. 

2. The system according to claim 1, wherein the first 
communications link includes a dial-up telephone line. 

3. TTie system according to claim 2, wherein the first 
communications link includes a modem. 

4. The system according to claim 1, wherein the second 
communications link includes an external network. 

5. The system according to claim 4, wherein the external 
network comprises the Internet. 

6. The system according to claim 4, wherein the first 
request is transmitted at least in part over the external 
network. 

7. The system according to claim 4, wherein the first 
request is transmitted at least in part over the Internet. 

8. The system according to claim 7, wherein the first 
request includes a Uniform Resource Locator (URL). 

9. The system according to claim 1, wherein the first 
request includes information relating to a secret shared by at 
least the trusted arbitrator and the connection entity. 

10. The system according to claim 1, wherein before the 
second communication is transmitted, a communications 
controller establishes the second communications link. 

11. The system according to claim 10, wherein the second 
communications link includes a dial-up telephone line. 

12. The system according to claim 11, wherein the com- 
munications controller is a dial-up router. 

13. The system according to claim 10, wherein the second 
communications link is established at least in part in 
response to a command transmitted by the connection entity. 

14. The system according to claim 1, wherein the second 
communications link includes a server, and 



wherein a portion of the second communications link 
between the connection entity and the server includes a 
dial-up telephone line. 

15. A method, comprising: 

receiving a first request from a remote entity, the first 
request being directed at least in part to a local entity in 
a local area network; 
verifying the remote entity as a valid requestor, 
transmitting a first communication to a connection entity 
in the local area network, the first communication being 
transmitted at least in part over a first communications 
link; 

terminating the first communications link after the first 

communication is completed; 
receiving a second communication from the connection 
entity, the second communication being received at 
least in part over a second communications link being 
a non-continuous communications link, 
wherein the second communication comprises informa- 
tion directed to the remote entity and is responsive to 
the first request; and 
relaying the second communication to the remote entity. 

16. The method according to claim 15, further comprising 
certifying the first request before transmitting the first com- 
munication. 

17. The method according to claim 16, wherein certifying 
the first request includes verifying identification information 
sent by the remote entity. 

18. The method according to claim 15, wherein the first 
request is received over the Internet. 

19. The method according to claim 15, wherein the second 
communication is received over the Internet. 

20. The method according to claim 15, wherein at least 
one among the first request and the second communication 
conform at least substantially to a Hypertext Transfer Pro- 
tocol. 

40 21. The method according to claim 15, wherein the first 
communications link includes a dial-up telephone line. 

22. A data storage medium having machine-readable code 
stored thereon, the machine-readable code comprising 
instructions executable by an array of logic elements, the 
45 instructions defining a method comprising: 

receiving a first request from a remote entity, the first 
request being directed at least in part to a local entity in 
a local area network; 
verifying the remote entity as a valid requester; 
transmitting a first communication to a connection entity 
in the local area network, the first communication being 
transmitted at least in part over a first communications 
link; 

terminating the first communications link after the first 

communication is completed; 
receiving a second communication from the connection 
entity, the second communication being received at 
least in part over a second communications link being 
a non-continuous communications link, 
wherein the second communication comprises informa- 
tion directed to the remote entity and is responsive to 
the first request; and 
relaying the second communication to the remote entity. 
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